Fortra GoAnywhere MFT SFTP Brute Force Vulnerability

The National Vulnerability Database has disclosed CVE-2026-0972, a critical vulnerability in Fortra’s GoAnywhere MFT. This flaw affects SFTP services prior to version 7.10.0, specifically when web users are configured for SSH key-based authentication. The system fails to enforce login attempt limits, creating a significant attack surface.

This lack of rate limiting allows attackers to repeatedly guess SSH keys via brute force. While SSH keys are inherently more secure than passwords, their strength relies on proper implementation and protection. Without login attempt throttling, a sufficiently persistent attacker can eventually compromise accounts, even with strong keys.

The CVSS score of 7.3 (HIGH) underscores the severity, with an attack vector that requires no user interaction and can be executed remotely (AV:N/UI:N). This directly impacts confidentiality, integrity, and availability (C:L/I:L/A:L) as successful brute-forcing grants unauthorized access and potentially allows data manipulation or exfiltration. Defenders must prioritize patching and review their GoAnywhere MFT configurations immediately.